In recent years, the adoption of Single Sign-On (SSO) has been progressing to reduce the burden of user account management in web services. In web services using OpenID Connect, a primary SSO protocol, the user is authenticated using an ID Token (IDT) issued by the identity provider. The Session Token (ST) generated after authentication is often used to authenticate subsequent requests. However, attackers can acquire victims’ IDT/ST through Cross-Site Scripting (XSS) or malicious browser extensions, enabling them to hijack sessions and impersonate victims. Related studies have proposed countermeasures against impersonation attacks using IDT/ST. Still, their effectiveness is limited against user-level malware (e.g., malicious browser extensions), making it impossible to prevent impersonation entirely. This study proposes OIPM (OpenID Connect Imper- sonation Prevention Mechanism) as a countermeasure to address the issue of impersonation using IDT/ST. Specifically, a unique private key is generated during user registration using FIDO, a passwordless authentication technology. This private key’s signature is verified during authentication to prevent impersonation, and a temporary private key generated at authentication is used for subsequent request verification. Additionally, post-authentication high-confidentiality operations require user verification through FIDO-based gestures such as fingerprints to ensure security against user-level malware.